I have been reluctant to replace core aspects of the git protocol as it is so battle tested.

Having a single git server that everyone pulls from isn't part of the protocol.

Its a point of centralisation and failure.

You have to trust that the operator is passing you the correct refs (as these are not signed although he commits maybe). Whats stopping them from pushing different commits to specific users or user from a specific country?

There is friction if you want change operator (as you need to coordinate with all the repo users to ge them to pull from a new url)